Local privilege escalation in CUPS with the cups-filters serial backend: an lpadmin user can add a printer using a privileged serial device URI; cupsd fails to restrict the path component of non-file device URIs, so the root-run backend writes attacker-controlled print data to arbitrary files, enabling CUPS config tampering and root code execution. Mitigate by removing/chmod 0755 …/cups/backend/serial, limiting lpadmin, set FileDevice No, keep SELinux enforcing.